Article URL: https://eaton-works.com/2026/07/27/my-eicher-hack/ Comments URL: https://news.ycombinator.com/item?id=49070756 Points: 41 # Comments: 6

Welcome to my next blockbuster automotive hack! This one has been in the works for a long time with roots going back to early 2024 when I disclosed the Toyota insurance company hack. Fun fact: I was actually trying to find a vulnerability in My Eicher at that time, but was unsuccessful. It wasn’t until more than a year later in 2025 that I stumbled upon a breakthrough that cracked My Eicher wide open. Unless you are in India, you probably haven’t heard of My Eicher before. It is an app/website that lets commercial vehicle customers track and manage their fleets of trucks and buses. You can do fun things like real-time-track vehicles, view the live gauge clusters, set geofences, and so much more. The website is here, and there is an Android and iPhone app. The vulnerabilities being disclosed here only impact commercial vehicles and customers in India. The vulnerability was incredibly simple and discovered through sheer luck. Here is an API that is used on the homepage of the website to check your mobile #: https://www.myeicher.in/cepauthmgr/user/validateMobileNo The Javascript on the website has many other APIs like that. There were some other interesting ones, but nothing that could be used to hack the entire platform. Then, just randomly one day, I decided to try going to this endpoint on my browser: https://www.myeicher.in/cepauthmgr/user/ In 99% of cases, walking up the API path results in an HTTP error. This time, it revealed a big list of all the user-related APIs: Even better, they were unauthenticated! I found a “customers” endpoint and it revealed a massive list of 748k customers: It even returned the password to you. It was encrypted though, so it couldn’t be used. This was still a massive breakthrough – it was no longer difficult to find people who use this system. These APIs gave me the entire list of accounts. If there was some sort of login exploit, it would be game over for everyone in here.